Threat Hunt: Potential Password Policy Discovery | Enumeration
Detects command-line and PowerShell attempts to discover Windows domain/local password policies, which adversaries use to plan brute-force attacks or credential exploitation. Each command is a reconnaissance step to answer: "How many guesses can I make before lockout?" "What password complexity rules exist?" "Which domains have weaker policies?" This aligns with MITRE’s definition of T1201.
Microsoft Sentinel (KQL)
